@xylex-group/athena 3.1.0 → 3.3.0

package/README.md

@@ -1,6 +1,6 @@
 # @xylex-group/athena
 
-current version: `3.1.0`
+current version: `3.3.0`
 Athena JS 3 is the runtime-neutral TypeScript SDK for Athena database, authentication, chat, and storage services.
 
 ## Install

package/dist/admin.cjs

@@ -1,6 +1,36 @@
 'use strict';
 
 // src/admin/index.ts
+function resolveAdminPermissionClient(client) {
+  if (!client || typeof client !== "object") {
+    return null;
+  }
+  const record = client;
+  const nestedAuth = record.auth;
+  if (nestedAuth && typeof nestedAuth === "object" && nestedAuth !== null && "admin" in nestedAuth) {
+    return client;
+  }
+  if ("admin" in record) {
+    return { auth: client };
+  }
+  return null;
+}
+function buildAdminAuthFetchOptions(credentials = {}) {
+  const cookie = credentials.cookie?.trim() || void 0;
+  const bearerToken = credentials.bearerToken?.trim() || void 0;
+  const headers = {};
+  if (cookie) {
+    headers.cookie = cookie;
+  }
+  if (bearerToken) {
+    headers.authorization = `Bearer ${bearerToken}`;
+  }
+  return {
+    credentials: "include",
+    ...bearerToken ? { bearerToken } : {},
+    ...Object.keys(headers).length > 0 ? { headers } : {}
+  };
+}
 function hasAdminRole(session) {
   const role = session?.user?.role;
   if (!role) {
@@ -8,6 +38,27 @@ function hasAdminRole(session) {
   }
   return role.split(",").map((item) => item.trim().toLowerCase()).includes("admin");
 }
+function mergeAdminFetchOptions(input) {
+  const fromCredentials = input.credentials ? buildAdminAuthFetchOptions(input.credentials) : void 0;
+  const explicit = input.fetchOptions;
+  if (!fromCredentials && !explicit) {
+    return void 0;
+  }
+  if (!fromCredentials) {
+    return explicit;
+  }
+  if (!explicit) {
+    return fromCredentials;
+  }
+  return {
+    ...fromCredentials,
+    ...explicit,
+    headers: {
+      ...fromCredentials.headers ?? {},
+      ...explicit.headers ?? {}
+    }
+  };
+}
 async function hasAdminPermission(client, input) {
   if (!input.session?.user?.id) {
     return false;
@@ -15,11 +66,12 @@ async function hasAdminPermission(client, input) {
   if (input.allowRoleBypass !== false && hasAdminRole(input.session)) {
     return true;
   }
+  const fetchOptions = mergeAdminFetchOptions(input);
   const result = await client.auth.admin.hasPermission(
     {
       permission: input.permission,
       permissions: input.permissions,
-      ...input.fetchOptions ? { fetchOptions: input.fetchOptions } : {}
+      ...fetchOptions ? { fetchOptions } : {}
     },
     input.requestOptions
   );
@@ -38,8 +90,10 @@ async function resolveAdminPermission(client, input) {
   };
 }
 
+exports.buildAdminAuthFetchOptions = buildAdminAuthFetchOptions;
 exports.hasAdminPermission = hasAdminPermission;
 exports.hasAdminRole = hasAdminRole;
 exports.resolveAdminPermission = resolveAdminPermission;
+exports.resolveAdminPermissionClient = resolveAdminPermissionClient;
 //# sourceMappingURL=admin.cjs.map
 //# sourceMappingURL=admin.cjs.map

package/dist/admin.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/admin/index.ts"],"names":[],"mappings":";;;AA4DO,SAAS,aACd,OAAA,EACS;AACT,EAAA,MAAM,IAAA,GAAO,SAAS,IAAA,EAAM,IAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA,CACJ,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAA,IAAA,KAAQ,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAa,CAAA,CACrC,SAAS,OAAO,CAAA;AACrB;AAQA,eAAsB,kBAAA,CACpB,QACA,KAAA,EACkB;AAClB,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,IAAA,EAAM,EAAA,EAAI;AAC5B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAM,eAAA,KAAoB,KAAA,IAAS,YAAA,CAAa,KAAA,CAAM,OAAO,CAAA,EAAG;AAClE,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,aAAA;AAAA,IACrC;AAAA,MACE,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,aAAa,KAAA,CAAM,WAAA;AAAA,MACnB,GAAI,MAAM,YAAA,GAAe,EAAE,cAAc,KAAA,CAAM,YAAA,KAAiB;AAAC,KACnE;AAAA,IACA,KAAA,CAAM;AAAA,GACR;AAEA,EAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,EAAA,IAAM,MAAA,CAAO,MAAM,OAAO,CAAA;AAClD;AAQA,eAAsB,sBAAA,CAGpB,QACA,KAAA,EAGgD;AAChD,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,GAAA,EAAK,OAAO,cAAA,EAAe;AAAA,EACzD;AAEA,EAAA,IAAI,CAAE,MAAM,kBAAA,CAAmB,MAAA,EAAQ,KAAK,CAAA,EAAI;AAC9C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,GAAA,EAAK,OAAO,WAAA,EAAY;AAAA,EACtD;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,SAAS,KAAA,CAAM;AAAA,GACjB;AACF","file":"admin.cjs","sourcesContent":["import type {\n  AthenaAdminHasPermissionRequest,\n  AthenaAuthBindings,\n  AthenaAuthCallOptions,\n  AthenaAuthFetchCompatibleInput,\n} from '../auth/types.ts'\n\n/**\n * Minimal session shape used by the admin convenience helpers.\n *\n * This stays framework-agnostic so callers can pass Athena auth sessions,\n * app-local session wrappers, or request-derived session snapshots.\n */\nexport interface AthenaAdminSessionLike {\n  user?: {\n    id?: string | null | undefined\n    role?: string | null | undefined\n  } | null | undefined\n  session?: {\n    token?: string | null | undefined\n    activeOrganizationId?: string | null | undefined\n  } | null | undefined\n}\n\nexport interface AthenaAdminPermissionClient {\n  auth: Pick<AthenaAuthBindings, 'admin'>\n}\n\nexport interface AthenaAdminPermissionCheckInput {\n  session: AthenaAdminSessionLike | null | undefined\n  permissions: AthenaAdminHasPermissionRequest['permissions']\n  permission?: AthenaAdminHasPermissionRequest['permission']\n  fetchOptions?: AthenaAuthFetchCompatibleInput['fetchOptions']\n  requestOptions?: AthenaAuthCallOptions\n  allowRoleBypass?: boolean\n}\n\nexport interface AthenaAdminPermissionSuccess<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n> {\n  ok: true\n  session: NonNullable<TSession>\n}\n\nexport interface AthenaAdminPermissionFailure {\n  ok: false\n  status: 401 | 403\n  error: 'Unauthorized' | 'Forbidden'\n}\n\nexport type AthenaAdminPermissionResult<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n> = AthenaAdminPermissionSuccess<TSession> | AthenaAdminPermissionFailure\n\n/**\n * Returns true when the session user already carries the `admin` role locally.\n *\n * Role strings are treated as a comma-separated list and normalized\n * case-insensitively so `\"admin\"`, `\"ADMIN\"`, and `\"member, admin\"` all pass.\n */\nexport function hasAdminRole(\n  session: AthenaAdminSessionLike | null | undefined,\n): boolean {\n  const role = session?.user?.role\n  if (!role) {\n    return false\n  }\n\n  return role\n    .split(',')\n    .map(item => item.trim().toLowerCase())\n    .includes('admin')\n}\n\n/**\n * Checks admin permission against the configured Athena auth client.\n *\n * This helper short-circuits when no session user is present and, by default,\n * trusts a local `admin` role before calling `client.auth.admin.hasPermission(...)`.\n */\nexport async function hasAdminPermission(\n  client: AthenaAdminPermissionClient,\n  input: AthenaAdminPermissionCheckInput,\n): Promise<boolean> {\n  if (!input.session?.user?.id) {\n    return false\n  }\n\n  if (input.allowRoleBypass !== false && hasAdminRole(input.session)) {\n    return true\n  }\n\n  const result = await client.auth.admin.hasPermission(\n    {\n      permission: input.permission,\n      permissions: input.permissions,\n      ...(input.fetchOptions ? { fetchOptions: input.fetchOptions } : {}),\n    },\n    input.requestOptions,\n  )\n\n  return Boolean(result.ok && result.data?.success)\n}\n\n/**\n * Resolves an admin permission check into a small framework-agnostic guard result.\n *\n * Consumers can map the returned `{ ok, status, error }` shape into Next.js,\n * Hono, Express, or any other response layer without importing framework types here.\n */\nexport async function resolveAdminPermission<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n>(\n  client: AthenaAdminPermissionClient,\n  input: Omit<AthenaAdminPermissionCheckInput, 'session'> & {\n    session: TSession | null | undefined\n  },\n): Promise<AthenaAdminPermissionResult<TSession>> {\n  if (!input.session) {\n    return { ok: false, status: 401, error: 'Unauthorized' }\n  }\n\n  if (!(await hasAdminPermission(client, input))) {\n    return { ok: false, status: 403, error: 'Forbidden' }\n  }\n\n  return {\n    ok: true,\n    session: input.session as NonNullable<TSession>,\n  }\n}\n"]}
+{"version":3,"sources":["../src/admin/index.ts"],"names":[],"mappings":";;;AAmCO,SAAS,6BACd,MAAA,EACoC;AACpC,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,MAAA,GAAS,MAAA;AACf,EAAA,MAAM,aAAa,MAAA,CAAO,IAAA;AAE1B,EAAA,IACE,cACA,OAAO,UAAA,KAAe,YACtB,UAAA,KAAe,IAAA,IACf,WAAW,UAAA,EACX;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,OAAO,EAAE,MAAM,MAAA,EAA4C;AAAA,EAC7D;AAEA,EAAA,OAAO,IAAA;AACT;AAmBO,SAAS,0BAAA,CACd,WAAA,GAA6C,EAAC,EACe;AAC7D,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,MAAA,EAAQ,IAAA,EAAK,IAAK,MAAA;AAC7C,EAAA,MAAM,WAAA,GAAc,WAAA,CAAY,WAAA,EAAa,IAAA,EAAK,IAAK,MAAA;AACvD,EAAA,MAAM,UAAkC,EAAC;AACzC,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,OAAA,CAAQ,MAAA,GAAS,MAAA;AAAA,EACnB;AACA,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,OAAA,CAAQ,aAAA,GAAgB,UAAU,WAAW,CAAA,CAAA;AAAA,EAC/C;AACA,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,SAAA;AAAA,IACb,GAAI,WAAA,GAAc,EAAE,WAAA,KAAgB,EAAC;AAAA,IACrC,GAAI,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,SAAS,CAAA,GAAI,EAAE,OAAA,EAAQ,GAAI;AAAC,GACvD;AACF;AAuCO,SAAS,aACd,OAAA,EACS;AACT,EAAA,MAAM,IAAA,GAAO,SAAS,IAAA,EAAM,IAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA,CACJ,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAA,IAAA,KAAQ,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAa,CAAA,CACrC,SAAS,OAAO,CAAA;AACrB;AAQA,SAAS,uBACP,KAAA,EAC4D;AAC5D,EAAA,MAAM,kBAAkB,KAAA,CAAM,WAAA,GAC1B,0BAAA,CAA2B,KAAA,CAAM,WAAW,CAAA,GAC5C,MAAA;AACJ,EAAA,MAAM,WAAW,KAAA,CAAM,YAAA;AACvB,EAAA,IAAI,CAAC,eAAA,IAAmB,CAAC,QAAA,EAAU;AACjC,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,OAAO,eAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,GAAG,eAAA;AAAA,IACH,GAAG,QAAA;AAAA,IACH,OAAA,EAAS;AAAA,MACP,GAAI,eAAA,CAAgB,OAAA,IAAW,EAAC;AAAA,MAChC,GAAI,QAAA,CAAS,OAAA,IAAW;AAAC;AAC3B,GACF;AACF;AAEA,eAAsB,kBAAA,CACpB,QACA,KAAA,EACkB;AAClB,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,IAAA,EAAM,EAAA,EAAI;AAC5B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAM,eAAA,KAAoB,KAAA,IAAS,YAAA,CAAa,KAAA,CAAM,OAAO,CAAA,EAAG;AAClE,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,YAAA,GAAe,uBAAuB,KAAK,CAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,aAAA;AAAA,IACrC;AAAA,MACE,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,aAAa,KAAA,CAAM,WAAA;AAAA,MACnB,GAAI,YAAA,GAAe,EAAE,YAAA,KAAiB;AAAC,KACzC;AAAA,IACA,KAAA,CAAM;AAAA,GACR;AAEA,EAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,EAAA,IAAM,MAAA,CAAO,MAAM,OAAO,CAAA;AAClD;AAQA,eAAsB,sBAAA,CAGpB,QACA,KAAA,EAGgD;AAChD,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,GAAA,EAAK,OAAO,cAAA,EAAe;AAAA,EACzD;AAEA,EAAA,IAAI,CAAE,MAAM,kBAAA,CAAmB,MAAA,EAAQ,KAAK,CAAA,EAAI;AAC9C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,GAAA,EAAK,OAAO,WAAA,EAAY;AAAA,EACtD;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,SAAS,KAAA,CAAM;AAAA,GACjB;AACF","file":"admin.cjs","sourcesContent":["import type {\n  AthenaAdminHasPermissionRequest,\n  AthenaAuthBindings,\n  AthenaAuthCallOptions,\n  AthenaAuthFetchCompatibleInput,\n} from '../auth/types.ts'\n\n/**\n * Minimal session shape used by the admin convenience helpers.\n *\n * This stays framework-agnostic so callers can pass Athena auth sessions,\n * app-local session wrappers, or request-derived session snapshots.\n */\nexport interface AthenaAdminSessionLike {\n  user?: {\n    id?: string | null | undefined\n    role?: string | null | undefined\n  } | null | undefined\n  session?: {\n    token?: string | null | undefined\n    activeOrganizationId?: string | null | undefined\n  } | null | undefined\n}\n\nexport interface AthenaAdminPermissionClient {\n  auth: Pick<AthenaAuthBindings, 'admin'>\n}\n\n/**\n * Normalizes common Athena client shapes into the admin-permission client contract.\n *\n * Accepts:\n * - `createClient(...)` → `{ auth: { admin } }`\n * - auth bindings only → `{ admin, … }` wrapped as `{ auth: bindings }`\n */\nexport function resolveAdminPermissionClient(\n  client: unknown,\n): AthenaAdminPermissionClient | null {\n  if (!client || typeof client !== 'object') {\n    return null\n  }\n\n  const record = client as Record<string, unknown>\n  const nestedAuth = record.auth\n\n  if (\n    nestedAuth &&\n    typeof nestedAuth === 'object' &&\n    nestedAuth !== null &&\n    'admin' in nestedAuth\n  ) {\n    return client as AthenaAdminPermissionClient\n  }\n\n  if ('admin' in record) {\n    return { auth: client as Pick<AthenaAuthBindings, 'admin'> }\n  }\n\n  return null\n}\n\n/**\n * Request credentials for admin permission checks without manual cookie\n * string matching. Prefer these over assembling `fetchOptions` by hand.\n */\nexport interface AthenaAdminRequestCredentials {\n  /** Raw `Cookie` header value from the current request. */\n  cookie?: string | null\n  /** Bearer token (without the `Bearer ` prefix). */\n  bearerToken?: string | null\n}\n\n/**\n * Build auth `fetchOptions` for admin routes from cookie and/or bearer.\n *\n * Replaces app helpers that inspect cookie strings for `athena-auth` /\n * `better-auth` prefixes before calling `hasPermission`.\n */\nexport function buildAdminAuthFetchOptions(\n  credentials: AthenaAdminRequestCredentials = {},\n): NonNullable<AthenaAuthFetchCompatibleInput['fetchOptions']> {\n  const cookie = credentials.cookie?.trim() || undefined\n  const bearerToken = credentials.bearerToken?.trim() || undefined\n  const headers: Record<string, string> = {}\n  if (cookie) {\n    headers.cookie = cookie\n  }\n  if (bearerToken) {\n    headers.authorization = `Bearer ${bearerToken}`\n  }\n  return {\n    credentials: 'include',\n    ...(bearerToken ? { bearerToken } : {}),\n    ...(Object.keys(headers).length > 0 ? { headers } : {}),\n  }\n}\n\nexport interface AthenaAdminPermissionCheckInput {\n  session: AthenaAdminSessionLike | null | undefined\n  permissions: AthenaAdminHasPermissionRequest['permissions']\n  permission?: AthenaAdminHasPermissionRequest['permission']\n  fetchOptions?: AthenaAuthFetchCompatibleInput['fetchOptions']\n  /**\n   * Cookie/bearer from the request. Merged under any explicit `fetchOptions`\n   * (explicit keys win on shallow header merge).\n   */\n  credentials?: AthenaAdminRequestCredentials\n  requestOptions?: AthenaAuthCallOptions\n  allowRoleBypass?: boolean\n}\n\nexport interface AthenaAdminPermissionSuccess<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n> {\n  ok: true\n  session: NonNullable<TSession>\n}\n\nexport interface AthenaAdminPermissionFailure {\n  ok: false\n  status: 401 | 403\n  error: 'Unauthorized' | 'Forbidden'\n}\n\nexport type AthenaAdminPermissionResult<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n> = AthenaAdminPermissionSuccess<TSession> | AthenaAdminPermissionFailure\n\n/**\n * Returns true when the session user already carries the `admin` role locally.\n *\n * Role strings are treated as a comma-separated list and normalized\n * case-insensitively so `\"admin\"`, `\"ADMIN\"`, and `\"member, admin\"` all pass.\n */\nexport function hasAdminRole(\n  session: AthenaAdminSessionLike | null | undefined,\n): boolean {\n  const role = session?.user?.role\n  if (!role) {\n    return false\n  }\n\n  return role\n    .split(',')\n    .map(item => item.trim().toLowerCase())\n    .includes('admin')\n}\n\n/**\n * Checks admin permission against the configured Athena auth client.\n *\n * This helper short-circuits when no session user is present and, by default,\n * trusts a local `admin` role before calling `client.auth.admin.hasPermission(...)`.\n */\nfunction mergeAdminFetchOptions(\n  input: AthenaAdminPermissionCheckInput,\n): AthenaAuthFetchCompatibleInput['fetchOptions'] | undefined {\n  const fromCredentials = input.credentials\n    ? buildAdminAuthFetchOptions(input.credentials)\n    : undefined\n  const explicit = input.fetchOptions\n  if (!fromCredentials && !explicit) {\n    return undefined\n  }\n  if (!fromCredentials) {\n    return explicit\n  }\n  if (!explicit) {\n    return fromCredentials\n  }\n  return {\n    ...fromCredentials,\n    ...explicit,\n    headers: {\n      ...(fromCredentials.headers ?? {}),\n      ...(explicit.headers ?? {}),\n    },\n  }\n}\n\nexport async function hasAdminPermission(\n  client: AthenaAdminPermissionClient,\n  input: AthenaAdminPermissionCheckInput,\n): Promise<boolean> {\n  if (!input.session?.user?.id) {\n    return false\n  }\n\n  if (input.allowRoleBypass !== false && hasAdminRole(input.session)) {\n    return true\n  }\n\n  const fetchOptions = mergeAdminFetchOptions(input)\n\n  const result = await client.auth.admin.hasPermission(\n    {\n      permission: input.permission,\n      permissions: input.permissions,\n      ...(fetchOptions ? { fetchOptions } : {}),\n    },\n    input.requestOptions,\n  )\n\n  return Boolean(result.ok && result.data?.success)\n}\n\n/**\n * Resolves an admin permission check into a small framework-agnostic guard result.\n *\n * Consumers can map the returned `{ ok, status, error }` shape into Next.js,\n * Hono, Express, or any other response layer without importing framework types here.\n */\nexport async function resolveAdminPermission<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n>(\n  client: AthenaAdminPermissionClient,\n  input: Omit<AthenaAdminPermissionCheckInput, 'session'> & {\n    session: TSession | null | undefined\n  },\n): Promise<AthenaAdminPermissionResult<TSession>> {\n  if (!input.session) {\n    return { ok: false, status: 401, error: 'Unauthorized' }\n  }\n\n  if (!(await hasAdminPermission(client, input))) {\n    return { ok: false, status: 403, error: 'Forbidden' }\n  }\n\n  return {\n    ok: true,\n    session: input.session as NonNullable<TSession>,\n  }\n}\n"]}

package/dist/admin.d.cts

@@ -1,4 +1,4 @@
-import { aD as AthenaAdminHasPermissionRequest, aE as AthenaAuthFetchCompatibleInput, E as AthenaAuthCallOptions, D as AthenaAuthBindings } from './types-AOY-GLu8.cjs';
+import { aD as AthenaAdminHasPermissionRequest, aE as AthenaAuthFetchCompatibleInput, E as AthenaAuthCallOptions, D as AthenaAuthBindings } from './types-BVKpQmfY.cjs';
 
 /**
  * Minimal session shape used by the admin convenience helpers.
@@ -19,11 +19,41 @@ interface AthenaAdminSessionLike {
 interface AthenaAdminPermissionClient {
     auth: Pick<AthenaAuthBindings, 'admin'>;
 }
+/**
+ * Normalizes common Athena client shapes into the admin-permission client contract.
+ *
+ * Accepts:
+ * - `createClient(...)` → `{ auth: { admin } }`
+ * - auth bindings only → `{ admin, … }` wrapped as `{ auth: bindings }`
+ */
+declare function resolveAdminPermissionClient(client: unknown): AthenaAdminPermissionClient | null;
+/**
+ * Request credentials for admin permission checks without manual cookie
+ * string matching. Prefer these over assembling `fetchOptions` by hand.
+ */
+interface AthenaAdminRequestCredentials {
+    /** Raw `Cookie` header value from the current request. */
+    cookie?: string | null;
+    /** Bearer token (without the `Bearer ` prefix). */
+    bearerToken?: string | null;
+}
+/**
+ * Build auth `fetchOptions` for admin routes from cookie and/or bearer.
+ *
+ * Replaces app helpers that inspect cookie strings for `athena-auth` /
+ * `better-auth` prefixes before calling `hasPermission`.
+ */
+declare function buildAdminAuthFetchOptions(credentials?: AthenaAdminRequestCredentials): NonNullable<AthenaAuthFetchCompatibleInput['fetchOptions']>;
 interface AthenaAdminPermissionCheckInput {
     session: AthenaAdminSessionLike | null | undefined;
     permissions: AthenaAdminHasPermissionRequest['permissions'];
     permission?: AthenaAdminHasPermissionRequest['permission'];
     fetchOptions?: AthenaAuthFetchCompatibleInput['fetchOptions'];
+    /**
+     * Cookie/bearer from the request. Merged under any explicit `fetchOptions`
+     * (explicit keys win on shallow header merge).
+     */
+    credentials?: AthenaAdminRequestCredentials;
     requestOptions?: AthenaAuthCallOptions;
     allowRoleBypass?: boolean;
 }
@@ -44,12 +74,6 @@ type AthenaAdminPermissionResult<TSession extends AthenaAdminSessionLike = Athen
  * case-insensitively so `"admin"`, `"ADMIN"`, and `"member, admin"` all pass.
  */
 declare function hasAdminRole(session: AthenaAdminSessionLike | null | undefined): boolean;
-/**
- * Checks admin permission against the configured Athena auth client.
- *
- * This helper short-circuits when no session user is present and, by default,
- * trusts a local `admin` role before calling `client.auth.admin.hasPermission(...)`.
- */
 declare function hasAdminPermission(client: AthenaAdminPermissionClient, input: AthenaAdminPermissionCheckInput): Promise<boolean>;
 /**
  * Resolves an admin permission check into a small framework-agnostic guard result.
@@ -61,4 +85,4 @@ declare function resolveAdminPermission<TSession extends AthenaAdminSessionLike
     session: TSession | null | undefined;
 }): Promise<AthenaAdminPermissionResult<TSession>>;
 
-export { type AthenaAdminPermissionCheckInput, type AthenaAdminPermissionClient, type AthenaAdminPermissionFailure, type AthenaAdminPermissionResult, type AthenaAdminPermissionSuccess, type AthenaAdminSessionLike, hasAdminPermission, hasAdminRole, resolveAdminPermission };
+export { type AthenaAdminPermissionCheckInput, type AthenaAdminPermissionClient, type AthenaAdminPermissionFailure, type AthenaAdminPermissionResult, type AthenaAdminPermissionSuccess, type AthenaAdminRequestCredentials, type AthenaAdminSessionLike, buildAdminAuthFetchOptions, hasAdminPermission, hasAdminRole, resolveAdminPermission, resolveAdminPermissionClient };

package/dist/admin.d.ts

@@ -1,4 +1,4 @@
-import { aD as AthenaAdminHasPermissionRequest, aE as AthenaAuthFetchCompatibleInput, E as AthenaAuthCallOptions, D as AthenaAuthBindings } from './types-AOY-GLu8.js';
+import { aD as AthenaAdminHasPermissionRequest, aE as AthenaAuthFetchCompatibleInput, E as AthenaAuthCallOptions, D as AthenaAuthBindings } from './types-BVKpQmfY.js';
 
 /**
  * Minimal session shape used by the admin convenience helpers.
@@ -19,11 +19,41 @@ interface AthenaAdminSessionLike {
 interface AthenaAdminPermissionClient {
     auth: Pick<AthenaAuthBindings, 'admin'>;
 }
+/**
+ * Normalizes common Athena client shapes into the admin-permission client contract.
+ *
+ * Accepts:
+ * - `createClient(...)` → `{ auth: { admin } }`
+ * - auth bindings only → `{ admin, … }` wrapped as `{ auth: bindings }`
+ */
+declare function resolveAdminPermissionClient(client: unknown): AthenaAdminPermissionClient | null;
+/**
+ * Request credentials for admin permission checks without manual cookie
+ * string matching. Prefer these over assembling `fetchOptions` by hand.
+ */
+interface AthenaAdminRequestCredentials {
+    /** Raw `Cookie` header value from the current request. */
+    cookie?: string | null;
+    /** Bearer token (without the `Bearer ` prefix). */
+    bearerToken?: string | null;
+}
+/**
+ * Build auth `fetchOptions` for admin routes from cookie and/or bearer.
+ *
+ * Replaces app helpers that inspect cookie strings for `athena-auth` /
+ * `better-auth` prefixes before calling `hasPermission`.
+ */
+declare function buildAdminAuthFetchOptions(credentials?: AthenaAdminRequestCredentials): NonNullable<AthenaAuthFetchCompatibleInput['fetchOptions']>;
 interface AthenaAdminPermissionCheckInput {
     session: AthenaAdminSessionLike | null | undefined;
     permissions: AthenaAdminHasPermissionRequest['permissions'];
     permission?: AthenaAdminHasPermissionRequest['permission'];
     fetchOptions?: AthenaAuthFetchCompatibleInput['fetchOptions'];
+    /**
+     * Cookie/bearer from the request. Merged under any explicit `fetchOptions`
+     * (explicit keys win on shallow header merge).
+     */
+    credentials?: AthenaAdminRequestCredentials;
     requestOptions?: AthenaAuthCallOptions;
     allowRoleBypass?: boolean;
 }
@@ -44,12 +74,6 @@ type AthenaAdminPermissionResult<TSession extends AthenaAdminSessionLike = Athen
  * case-insensitively so `"admin"`, `"ADMIN"`, and `"member, admin"` all pass.
  */
 declare function hasAdminRole(session: AthenaAdminSessionLike | null | undefined): boolean;
-/**
- * Checks admin permission against the configured Athena auth client.
- *
- * This helper short-circuits when no session user is present and, by default,
- * trusts a local `admin` role before calling `client.auth.admin.hasPermission(...)`.
- */
 declare function hasAdminPermission(client: AthenaAdminPermissionClient, input: AthenaAdminPermissionCheckInput): Promise<boolean>;
 /**
  * Resolves an admin permission check into a small framework-agnostic guard result.
@@ -61,4 +85,4 @@ declare function resolveAdminPermission<TSession extends AthenaAdminSessionLike
     session: TSession | null | undefined;
 }): Promise<AthenaAdminPermissionResult<TSession>>;
 
-export { type AthenaAdminPermissionCheckInput, type AthenaAdminPermissionClient, type AthenaAdminPermissionFailure, type AthenaAdminPermissionResult, type AthenaAdminPermissionSuccess, type AthenaAdminSessionLike, hasAdminPermission, hasAdminRole, resolveAdminPermission };
+export { type AthenaAdminPermissionCheckInput, type AthenaAdminPermissionClient, type AthenaAdminPermissionFailure, type AthenaAdminPermissionResult, type AthenaAdminPermissionSuccess, type AthenaAdminRequestCredentials, type AthenaAdminSessionLike, buildAdminAuthFetchOptions, hasAdminPermission, hasAdminRole, resolveAdminPermission, resolveAdminPermissionClient };

package/dist/admin.js

@@ -1,4 +1,34 @@
 // src/admin/index.ts
+function resolveAdminPermissionClient(client) {
+  if (!client || typeof client !== "object") {
+    return null;
+  }
+  const record = client;
+  const nestedAuth = record.auth;
+  if (nestedAuth && typeof nestedAuth === "object" && nestedAuth !== null && "admin" in nestedAuth) {
+    return client;
+  }
+  if ("admin" in record) {
+    return { auth: client };
+  }
+  return null;
+}
+function buildAdminAuthFetchOptions(credentials = {}) {
+  const cookie = credentials.cookie?.trim() || void 0;
+  const bearerToken = credentials.bearerToken?.trim() || void 0;
+  const headers = {};
+  if (cookie) {
+    headers.cookie = cookie;
+  }
+  if (bearerToken) {
+    headers.authorization = `Bearer ${bearerToken}`;
+  }
+  return {
+    credentials: "include",
+    ...bearerToken ? { bearerToken } : {},
+    ...Object.keys(headers).length > 0 ? { headers } : {}
+  };
+}
 function hasAdminRole(session) {
   const role = session?.user?.role;
   if (!role) {
@@ -6,6 +36,27 @@ function hasAdminRole(session) {
   }
   return role.split(",").map((item) => item.trim().toLowerCase()).includes("admin");
 }
+function mergeAdminFetchOptions(input) {
+  const fromCredentials = input.credentials ? buildAdminAuthFetchOptions(input.credentials) : void 0;
+  const explicit = input.fetchOptions;
+  if (!fromCredentials && !explicit) {
+    return void 0;
+  }
+  if (!fromCredentials) {
+    return explicit;
+  }
+  if (!explicit) {
+    return fromCredentials;
+  }
+  return {
+    ...fromCredentials,
+    ...explicit,
+    headers: {
+      ...fromCredentials.headers ?? {},
+      ...explicit.headers ?? {}
+    }
+  };
+}
 async function hasAdminPermission(client, input) {
   if (!input.session?.user?.id) {
     return false;
@@ -13,11 +64,12 @@ async function hasAdminPermission(client, input) {
   if (input.allowRoleBypass !== false && hasAdminRole(input.session)) {
     return true;
   }
+  const fetchOptions = mergeAdminFetchOptions(input);
   const result = await client.auth.admin.hasPermission(
     {
       permission: input.permission,
       permissions: input.permissions,
-      ...input.fetchOptions ? { fetchOptions: input.fetchOptions } : {}
+      ...fetchOptions ? { fetchOptions } : {}
     },
     input.requestOptions
   );
@@ -36,6 +88,6 @@ async function resolveAdminPermission(client, input) {
   };
 }
 
-export { hasAdminPermission, hasAdminRole, resolveAdminPermission };
+export { buildAdminAuthFetchOptions, hasAdminPermission, hasAdminRole, resolveAdminPermission, resolveAdminPermissionClient };
 //# sourceMappingURL=admin.js.map
 //# sourceMappingURL=admin.js.map

package/dist/admin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/admin/index.ts"],"names":[],"mappings":";AA4DO,SAAS,aACd,OAAA,EACS;AACT,EAAA,MAAM,IAAA,GAAO,SAAS,IAAA,EAAM,IAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA,CACJ,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAA,IAAA,KAAQ,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAa,CAAA,CACrC,SAAS,OAAO,CAAA;AACrB;AAQA,eAAsB,kBAAA,CACpB,QACA,KAAA,EACkB;AAClB,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,IAAA,EAAM,EAAA,EAAI;AAC5B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAM,eAAA,KAAoB,KAAA,IAAS,YAAA,CAAa,KAAA,CAAM,OAAO,CAAA,EAAG;AAClE,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,aAAA;AAAA,IACrC;AAAA,MACE,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,aAAa,KAAA,CAAM,WAAA;AAAA,MACnB,GAAI,MAAM,YAAA,GAAe,EAAE,cAAc,KAAA,CAAM,YAAA,KAAiB;AAAC,KACnE;AAAA,IACA,KAAA,CAAM;AAAA,GACR;AAEA,EAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,EAAA,IAAM,MAAA,CAAO,MAAM,OAAO,CAAA;AAClD;AAQA,eAAsB,sBAAA,CAGpB,QACA,KAAA,EAGgD;AAChD,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,GAAA,EAAK,OAAO,cAAA,EAAe;AAAA,EACzD;AAEA,EAAA,IAAI,CAAE,MAAM,kBAAA,CAAmB,MAAA,EAAQ,KAAK,CAAA,EAAI;AAC9C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,GAAA,EAAK,OAAO,WAAA,EAAY;AAAA,EACtD;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,SAAS,KAAA,CAAM;AAAA,GACjB;AACF","file":"admin.js","sourcesContent":["import type {\n  AthenaAdminHasPermissionRequest,\n  AthenaAuthBindings,\n  AthenaAuthCallOptions,\n  AthenaAuthFetchCompatibleInput,\n} from '../auth/types.ts'\n\n/**\n * Minimal session shape used by the admin convenience helpers.\n *\n * This stays framework-agnostic so callers can pass Athena auth sessions,\n * app-local session wrappers, or request-derived session snapshots.\n */\nexport interface AthenaAdminSessionLike {\n  user?: {\n    id?: string | null | undefined\n    role?: string | null | undefined\n  } | null | undefined\n  session?: {\n    token?: string | null | undefined\n    activeOrganizationId?: string | null | undefined\n  } | null | undefined\n}\n\nexport interface AthenaAdminPermissionClient {\n  auth: Pick<AthenaAuthBindings, 'admin'>\n}\n\nexport interface AthenaAdminPermissionCheckInput {\n  session: AthenaAdminSessionLike | null | undefined\n  permissions: AthenaAdminHasPermissionRequest['permissions']\n  permission?: AthenaAdminHasPermissionRequest['permission']\n  fetchOptions?: AthenaAuthFetchCompatibleInput['fetchOptions']\n  requestOptions?: AthenaAuthCallOptions\n  allowRoleBypass?: boolean\n}\n\nexport interface AthenaAdminPermissionSuccess<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n> {\n  ok: true\n  session: NonNullable<TSession>\n}\n\nexport interface AthenaAdminPermissionFailure {\n  ok: false\n  status: 401 | 403\n  error: 'Unauthorized' | 'Forbidden'\n}\n\nexport type AthenaAdminPermissionResult<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n> = AthenaAdminPermissionSuccess<TSession> | AthenaAdminPermissionFailure\n\n/**\n * Returns true when the session user already carries the `admin` role locally.\n *\n * Role strings are treated as a comma-separated list and normalized\n * case-insensitively so `\"admin\"`, `\"ADMIN\"`, and `\"member, admin\"` all pass.\n */\nexport function hasAdminRole(\n  session: AthenaAdminSessionLike | null | undefined,\n): boolean {\n  const role = session?.user?.role\n  if (!role) {\n    return false\n  }\n\n  return role\n    .split(',')\n    .map(item => item.trim().toLowerCase())\n    .includes('admin')\n}\n\n/**\n * Checks admin permission against the configured Athena auth client.\n *\n * This helper short-circuits when no session user is present and, by default,\n * trusts a local `admin` role before calling `client.auth.admin.hasPermission(...)`.\n */\nexport async function hasAdminPermission(\n  client: AthenaAdminPermissionClient,\n  input: AthenaAdminPermissionCheckInput,\n): Promise<boolean> {\n  if (!input.session?.user?.id) {\n    return false\n  }\n\n  if (input.allowRoleBypass !== false && hasAdminRole(input.session)) {\n    return true\n  }\n\n  const result = await client.auth.admin.hasPermission(\n    {\n      permission: input.permission,\n      permissions: input.permissions,\n      ...(input.fetchOptions ? { fetchOptions: input.fetchOptions } : {}),\n    },\n    input.requestOptions,\n  )\n\n  return Boolean(result.ok && result.data?.success)\n}\n\n/**\n * Resolves an admin permission check into a small framework-agnostic guard result.\n *\n * Consumers can map the returned `{ ok, status, error }` shape into Next.js,\n * Hono, Express, or any other response layer without importing framework types here.\n */\nexport async function resolveAdminPermission<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n>(\n  client: AthenaAdminPermissionClient,\n  input: Omit<AthenaAdminPermissionCheckInput, 'session'> & {\n    session: TSession | null | undefined\n  },\n): Promise<AthenaAdminPermissionResult<TSession>> {\n  if (!input.session) {\n    return { ok: false, status: 401, error: 'Unauthorized' }\n  }\n\n  if (!(await hasAdminPermission(client, input))) {\n    return { ok: false, status: 403, error: 'Forbidden' }\n  }\n\n  return {\n    ok: true,\n    session: input.session as NonNullable<TSession>,\n  }\n}\n"]}
+{"version":3,"sources":["../src/admin/index.ts"],"names":[],"mappings":";AAmCO,SAAS,6BACd,MAAA,EACoC;AACpC,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACzC,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,MAAA,GAAS,MAAA;AACf,EAAA,MAAM,aAAa,MAAA,CAAO,IAAA;AAE1B,EAAA,IACE,cACA,OAAO,UAAA,KAAe,YACtB,UAAA,KAAe,IAAA,IACf,WAAW,UAAA,EACX;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,OAAO,EAAE,MAAM,MAAA,EAA4C;AAAA,EAC7D;AAEA,EAAA,OAAO,IAAA;AACT;AAmBO,SAAS,0BAAA,CACd,WAAA,GAA6C,EAAC,EACe;AAC7D,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,MAAA,EAAQ,IAAA,EAAK,IAAK,MAAA;AAC7C,EAAA,MAAM,WAAA,GAAc,WAAA,CAAY,WAAA,EAAa,IAAA,EAAK,IAAK,MAAA;AACvD,EAAA,MAAM,UAAkC,EAAC;AACzC,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,OAAA,CAAQ,MAAA,GAAS,MAAA;AAAA,EACnB;AACA,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,OAAA,CAAQ,aAAA,GAAgB,UAAU,WAAW,CAAA,CAAA;AAAA,EAC/C;AACA,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,SAAA;AAAA,IACb,GAAI,WAAA,GAAc,EAAE,WAAA,KAAgB,EAAC;AAAA,IACrC,GAAI,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,SAAS,CAAA,GAAI,EAAE,OAAA,EAAQ,GAAI;AAAC,GACvD;AACF;AAuCO,SAAS,aACd,OAAA,EACS;AACT,EAAA,MAAM,IAAA,GAAO,SAAS,IAAA,EAAM,IAAA;AAC5B,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA,CACJ,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAA,IAAA,KAAQ,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAa,CAAA,CACrC,SAAS,OAAO,CAAA;AACrB;AAQA,SAAS,uBACP,KAAA,EAC4D;AAC5D,EAAA,MAAM,kBAAkB,KAAA,CAAM,WAAA,GAC1B,0BAAA,CAA2B,KAAA,CAAM,WAAW,CAAA,GAC5C,MAAA;AACJ,EAAA,MAAM,WAAW,KAAA,CAAM,YAAA;AACvB,EAAA,IAAI,CAAC,eAAA,IAAmB,CAAC,QAAA,EAAU;AACjC,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,OAAO,eAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,GAAG,eAAA;AAAA,IACH,GAAG,QAAA;AAAA,IACH,OAAA,EAAS;AAAA,MACP,GAAI,eAAA,CAAgB,OAAA,IAAW,EAAC;AAAA,MAChC,GAAI,QAAA,CAAS,OAAA,IAAW;AAAC;AAC3B,GACF;AACF;AAEA,eAAsB,kBAAA,CACpB,QACA,KAAA,EACkB;AAClB,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,EAAS,IAAA,EAAM,EAAA,EAAI;AAC5B,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,IAAI,MAAM,eAAA,KAAoB,KAAA,IAAS,YAAA,CAAa,KAAA,CAAM,OAAO,CAAA,EAAG;AAClE,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,YAAA,GAAe,uBAAuB,KAAK,CAAA;AAEjD,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,aAAA;AAAA,IACrC;AAAA,MACE,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,aAAa,KAAA,CAAM,WAAA;AAAA,MACnB,GAAI,YAAA,GAAe,EAAE,YAAA,KAAiB;AAAC,KACzC;AAAA,IACA,KAAA,CAAM;AAAA,GACR;AAEA,EAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,EAAA,IAAM,MAAA,CAAO,MAAM,OAAO,CAAA;AAClD;AAQA,eAAsB,sBAAA,CAGpB,QACA,KAAA,EAGgD;AAChD,EAAA,IAAI,CAAC,MAAM,OAAA,EAAS;AAClB,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,GAAA,EAAK,OAAO,cAAA,EAAe;AAAA,EACzD;AAEA,EAAA,IAAI,CAAE,MAAM,kBAAA,CAAmB,MAAA,EAAQ,KAAK,CAAA,EAAI;AAC9C,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,GAAA,EAAK,OAAO,WAAA,EAAY;AAAA,EACtD;AAEA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,SAAS,KAAA,CAAM;AAAA,GACjB;AACF","file":"admin.js","sourcesContent":["import type {\n  AthenaAdminHasPermissionRequest,\n  AthenaAuthBindings,\n  AthenaAuthCallOptions,\n  AthenaAuthFetchCompatibleInput,\n} from '../auth/types.ts'\n\n/**\n * Minimal session shape used by the admin convenience helpers.\n *\n * This stays framework-agnostic so callers can pass Athena auth sessions,\n * app-local session wrappers, or request-derived session snapshots.\n */\nexport interface AthenaAdminSessionLike {\n  user?: {\n    id?: string | null | undefined\n    role?: string | null | undefined\n  } | null | undefined\n  session?: {\n    token?: string | null | undefined\n    activeOrganizationId?: string | null | undefined\n  } | null | undefined\n}\n\nexport interface AthenaAdminPermissionClient {\n  auth: Pick<AthenaAuthBindings, 'admin'>\n}\n\n/**\n * Normalizes common Athena client shapes into the admin-permission client contract.\n *\n * Accepts:\n * - `createClient(...)` → `{ auth: { admin } }`\n * - auth bindings only → `{ admin, … }` wrapped as `{ auth: bindings }`\n */\nexport function resolveAdminPermissionClient(\n  client: unknown,\n): AthenaAdminPermissionClient | null {\n  if (!client || typeof client !== 'object') {\n    return null\n  }\n\n  const record = client as Record<string, unknown>\n  const nestedAuth = record.auth\n\n  if (\n    nestedAuth &&\n    typeof nestedAuth === 'object' &&\n    nestedAuth !== null &&\n    'admin' in nestedAuth\n  ) {\n    return client as AthenaAdminPermissionClient\n  }\n\n  if ('admin' in record) {\n    return { auth: client as Pick<AthenaAuthBindings, 'admin'> }\n  }\n\n  return null\n}\n\n/**\n * Request credentials for admin permission checks without manual cookie\n * string matching. Prefer these over assembling `fetchOptions` by hand.\n */\nexport interface AthenaAdminRequestCredentials {\n  /** Raw `Cookie` header value from the current request. */\n  cookie?: string | null\n  /** Bearer token (without the `Bearer ` prefix). */\n  bearerToken?: string | null\n}\n\n/**\n * Build auth `fetchOptions` for admin routes from cookie and/or bearer.\n *\n * Replaces app helpers that inspect cookie strings for `athena-auth` /\n * `better-auth` prefixes before calling `hasPermission`.\n */\nexport function buildAdminAuthFetchOptions(\n  credentials: AthenaAdminRequestCredentials = {},\n): NonNullable<AthenaAuthFetchCompatibleInput['fetchOptions']> {\n  const cookie = credentials.cookie?.trim() || undefined\n  const bearerToken = credentials.bearerToken?.trim() || undefined\n  const headers: Record<string, string> = {}\n  if (cookie) {\n    headers.cookie = cookie\n  }\n  if (bearerToken) {\n    headers.authorization = `Bearer ${bearerToken}`\n  }\n  return {\n    credentials: 'include',\n    ...(bearerToken ? { bearerToken } : {}),\n    ...(Object.keys(headers).length > 0 ? { headers } : {}),\n  }\n}\n\nexport interface AthenaAdminPermissionCheckInput {\n  session: AthenaAdminSessionLike | null | undefined\n  permissions: AthenaAdminHasPermissionRequest['permissions']\n  permission?: AthenaAdminHasPermissionRequest['permission']\n  fetchOptions?: AthenaAuthFetchCompatibleInput['fetchOptions']\n  /**\n   * Cookie/bearer from the request. Merged under any explicit `fetchOptions`\n   * (explicit keys win on shallow header merge).\n   */\n  credentials?: AthenaAdminRequestCredentials\n  requestOptions?: AthenaAuthCallOptions\n  allowRoleBypass?: boolean\n}\n\nexport interface AthenaAdminPermissionSuccess<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n> {\n  ok: true\n  session: NonNullable<TSession>\n}\n\nexport interface AthenaAdminPermissionFailure {\n  ok: false\n  status: 401 | 403\n  error: 'Unauthorized' | 'Forbidden'\n}\n\nexport type AthenaAdminPermissionResult<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n> = AthenaAdminPermissionSuccess<TSession> | AthenaAdminPermissionFailure\n\n/**\n * Returns true when the session user already carries the `admin` role locally.\n *\n * Role strings are treated as a comma-separated list and normalized\n * case-insensitively so `\"admin\"`, `\"ADMIN\"`, and `\"member, admin\"` all pass.\n */\nexport function hasAdminRole(\n  session: AthenaAdminSessionLike | null | undefined,\n): boolean {\n  const role = session?.user?.role\n  if (!role) {\n    return false\n  }\n\n  return role\n    .split(',')\n    .map(item => item.trim().toLowerCase())\n    .includes('admin')\n}\n\n/**\n * Checks admin permission against the configured Athena auth client.\n *\n * This helper short-circuits when no session user is present and, by default,\n * trusts a local `admin` role before calling `client.auth.admin.hasPermission(...)`.\n */\nfunction mergeAdminFetchOptions(\n  input: AthenaAdminPermissionCheckInput,\n): AthenaAuthFetchCompatibleInput['fetchOptions'] | undefined {\n  const fromCredentials = input.credentials\n    ? buildAdminAuthFetchOptions(input.credentials)\n    : undefined\n  const explicit = input.fetchOptions\n  if (!fromCredentials && !explicit) {\n    return undefined\n  }\n  if (!fromCredentials) {\n    return explicit\n  }\n  if (!explicit) {\n    return fromCredentials\n  }\n  return {\n    ...fromCredentials,\n    ...explicit,\n    headers: {\n      ...(fromCredentials.headers ?? {}),\n      ...(explicit.headers ?? {}),\n    },\n  }\n}\n\nexport async function hasAdminPermission(\n  client: AthenaAdminPermissionClient,\n  input: AthenaAdminPermissionCheckInput,\n): Promise<boolean> {\n  if (!input.session?.user?.id) {\n    return false\n  }\n\n  if (input.allowRoleBypass !== false && hasAdminRole(input.session)) {\n    return true\n  }\n\n  const fetchOptions = mergeAdminFetchOptions(input)\n\n  const result = await client.auth.admin.hasPermission(\n    {\n      permission: input.permission,\n      permissions: input.permissions,\n      ...(fetchOptions ? { fetchOptions } : {}),\n    },\n    input.requestOptions,\n  )\n\n  return Boolean(result.ok && result.data?.success)\n}\n\n/**\n * Resolves an admin permission check into a small framework-agnostic guard result.\n *\n * Consumers can map the returned `{ ok, status, error }` shape into Next.js,\n * Hono, Express, or any other response layer without importing framework types here.\n */\nexport async function resolveAdminPermission<\n  TSession extends AthenaAdminSessionLike = AthenaAdminSessionLike,\n>(\n  client: AthenaAdminPermissionClient,\n  input: Omit<AthenaAdminPermissionCheckInput, 'session'> & {\n    session: TSession | null | undefined\n  },\n): Promise<AthenaAdminPermissionResult<TSession>> {\n  if (!input.session) {\n    return { ok: false, status: 401, error: 'Unauthorized' }\n  }\n\n  if (!(await hasAdminPermission(client, input))) {\n    return { ok: false, status: 403, error: 'Forbidden' }\n  }\n\n  return {\n    ok: true,\n    session: input.session as NonNullable<TSession>,\n  }\n}\n"]}

package/dist/athena-auth-url-C1FbVmN6.d.cts

@@ -0,0 +1,200 @@
+/**
+ * Resolve Athena Auth base / upstream URLs from env or explicit config.
+ *
+ * Mirrors the Athena Auth UI base-url contract so apps and the SDK share one
+ * precedence order for `ATHENA_AUTH_*` environment variables.
+ */
+/** Default browser/proxy path for same-origin auth routing. */
+declare const ATHENA_AUTH_PATH = "/api/auth";
+/** Fallback origin when no absolute upstream is configured (server-side). */
+declare const LOCAL_DEV_ORIGIN = "http://localhost:3000";
+/**
+ * Hosted Athena Auth origin used when no upstream override is supplied.
+ * Origin only — no `/api/auth` suffix.
+ */
+declare const DEFAULT_ATHENA_AUTH_ORIGIN = "https://auth.athena-auth.com";
+/**
+ * @deprecated Prefer {@link DEFAULT_ATHENA_AUTH_ORIGIN}.
+ * Kept for callers that used the older name.
+ */
+declare const DEFAULT_ATHENA_AUTH_UPSTREAM_URL = "https://auth.athena-auth.com";
+/**
+ * Environment keys checked (in order) for the Athena Auth upstream URL.
+ *
+ * Prefer server-only keys first so private upstream hosts are not forced to
+ * rely on `NEXT_PUBLIC_*` values.
+ */
+declare const ATHENA_AUTH_UPSTREAM_ENV_KEYS: readonly ["ATHENA_AUTH_UPSTREAM_URL", "ATHENA_AUTH_URL", "NEXT_PUBLIC_ATHENA_AUTH_UPSTREAM_URL", "NEXT_PUBLIC_ATHENA_AUTH_URL"];
+/**
+ * Auth UI naming parity (`base-url.ts`).
+ * Same ordered list as {@link ATHENA_AUTH_UPSTREAM_ENV_KEYS}.
+ */
+declare const ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES: readonly ["ATHENA_AUTH_UPSTREAM_URL", "ATHENA_AUTH_URL", "NEXT_PUBLIC_ATHENA_AUTH_UPSTREAM_URL", "NEXT_PUBLIC_ATHENA_AUTH_URL"];
+type AthenaAuthUpstreamEnvKey = (typeof ATHENA_AUTH_UPSTREAM_ENV_KEYS)[number];
+/** Loose env map (Node `process.env` or a test fixture). */
+type EnvLike = Record<string, string | undefined>;
+type AthenaAuthUpstreamEnv = Partial<Record<AthenaAuthUpstreamEnvKey, string | undefined>> & EnvLike;
+interface AthenaAuthClientBaseUrlOptions {
+    /**
+     * When `true` (default), ensure the client base ends with `/api/auth`.
+     * Set `false` when the auth server is mounted at a custom path or root.
+     */
+    appendAuthPath?: boolean;
+}
+/**
+ * Returns `true` when the value is an absolute `http://` or `https://` URL.
+ */
+declare function isAbsoluteUrl(value: string): boolean;
+/**
+ * Read the first non-empty Athena Auth upstream URL from an env-like map.
+ *
+ * @returns Trimmed URL string, or `undefined` when none of the keys are set
+ */
+declare function readAthenaAuthUpstreamUrlFromEnv(env: EnvLike): string | undefined;
+/**
+ * Normalize a consumer-supplied auth base URL so it targets `/api/auth`
+ * (unless the path already ends with that segment).
+ *
+ * Absolute URLs keep origin and rewrite pathname; relative paths are ensured
+ * to end with `/api/auth`.
+ *
+ * @example
+ * ```ts
+ * normalizeAthenaAuthBaseUrl('https://auth.example.com')
+ * // => 'https://auth.example.com/api/auth'
+ *
+ * normalizeAthenaAuthBaseUrl('/api/auth')
+ * // => '/api/auth'
+ * ```
+ */
+declare function normalizeAthenaAuthBaseUrl(urlOrPath: string): string;
+/**
+ * Resolve the **server-side** Athena Auth upstream origin (no `/api/auth` suffix).
+ *
+ * Used when proxying or calling the auth host directly from Node / edge.
+ *
+ * @param rawUpstreamUrl - Explicit URL, env map, or omit to read `process.env`
+ * @returns Origin like `https://auth.example.com` (no trailing slash)
+ */
+declare function resolveAthenaAuthUpstreamUrl(rawUpstreamUrl?: string | AthenaAuthUpstreamEnv): string;
+/**
+ * Resolve the **browser-facing** auth client base URL.
+ *
+ * Default behavior appends `/api/auth` for same-origin proxying. Pass
+ * `{ appendAuthPath: false }` to keep a custom path or root mount.
+ *
+ * Overloads match common call styles from Athena Auth UI and app code:
+ * - `resolveAthenaAuthClientBaseUrl("https://auth.example.com")`
+ * - `resolveAthenaAuthClientBaseUrl(process.env)`
+ * - `resolveAthenaAuthClientBaseUrl(undefined)` → env + defaults
+ * - `resolveAthenaAuthClientBaseUrl(path, upstream, { appendAuthPath: false })`
+ */
+declare function resolveAthenaAuthClientBaseUrl(configuredAuthBaseUrl?: string | EnvLike, rawUpstreamUrl?: string | AthenaAuthUpstreamEnv, options?: AthenaAuthClientBaseUrlOptions): string;
+declare function resolveAthenaAuthClientBaseUrl(configuredAuthBaseUrl: string, rawUpstreamUrl?: string | AthenaAuthUpstreamEnv, options?: AthenaAuthClientBaseUrlOptions): string;
+/**
+ * Build an absolute Athena Auth request URL for a path under the client base.
+ *
+ * Resolves at **call time** (reads env when `rawBaseUrl` is omitted) so module
+ * load order does not freeze a stale URL.
+ *
+ * @param path - Path relative to the auth base (leading slashes stripped)
+ * @param rawBaseUrl - Optional base string or env map
+ *
+ * @example
+ * ```ts
+ * resolveAthenaAuthRequestUrl('get-session', 'https://auth.example.com')
+ * // => 'https://auth.example.com/api/auth/get-session'
+ * ```
+ */
+declare function resolveAthenaAuthRequestUrl(path: string, rawBaseUrl?: string | EnvLike): string;
+/** Relative auth path for email verification (`GET /verify-email`). */
+declare const ATHENA_AUTH_VERIFY_EMAIL_PATH = "verify-email";
+/**
+ * Relative segment for session lookup (`GET /get-session`).
+ * Prefer with {@link resolveAthenaAuthRequestUrl} when `base` already ends in `/api/auth`.
+ */
+declare const ATHENA_AUTH_GET_SESSION_PATH = "get-session";
+/**
+ * Absolute app/proxy path for session lookup.
+ * Use with `new URL(ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH, appOrigin)` when
+ * `baseUrl` is the **app origin** (e.g. `https://app.example.com`), not the auth client base.
+ */
+declare const ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH = "/api/auth/get-session";
+/**
+ * @deprecated Alias of {@link ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH} for drop-in
+ * replacement of app-local `AUTH_SESSION_PATH` constants. Prefer the `ATHENA_` name.
+ */
+declare const AUTH_SESSION_PATH = "/api/auth/get-session";
+/**
+ * Query param that forces Athena Auth / Better Auth style session handlers to
+ * skip cookie cache and re-read the live session cookie.
+ */
+declare const ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM = "disableCookieCache";
+/**
+ * @deprecated Alias of {@link ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM}.
+ */
+declare const DISABLE_COOKIE_CACHE_QUERY_PARAM = "disableCookieCache";
+/** Value paired with {@link ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM}. */
+declare const ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE = "true";
+/**
+ * @deprecated Alias of {@link ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE}.
+ */
+declare const DISABLE_COOKIE_CACHE_QUERY_VALUE = "true";
+/**
+ * Optional request/response header some apps use to pass serialized session
+ * payload between edge middleware and the app (not set by the SDK itself).
+ */
+declare const ATHENA_SESSION_DATA_HEADER = "x-session-data";
+/**
+ * @deprecated Alias of {@link ATHENA_SESSION_DATA_HEADER}.
+ */
+declare const SESSION_DATA_HEADER = "x-session-data";
+/**
+ * Absolute callback URL for email verification.
+ *
+ * Equivalent to `resolveAthenaAuthRequestUrl("verify-email")` — use this in
+ * sign-up / send-verification payloads as `callbackURL` instead of a local
+ * wrapper around Auth UI `base-url` helpers.
+ *
+ * @param rawBaseUrl - Optional base string or env map (defaults to process env)
+ * @returns e.g. `https://auth.example.com/api/auth/verify-email`
+ *
+ * @example
+ * ```ts
+ * import { resolveEmailVerificationCallbackUrl } from "@xylex-group/athena/utils"
+ *
+ * await client.auth.signUp.email({
+ *   email,
+ *   password,
+ *   name,
+ *   callbackURL: resolveEmailVerificationCallbackUrl(),
+ * })
+ * ```
+ */
+declare function resolveEmailVerificationCallbackUrl(rawBaseUrl?: string | EnvLike): string;
+/**
+ * Build a same-origin (or absolute) **fresh** get-session URL.
+ *
+ * Appends `disableCookieCache=true` so middleware / RSC session probes do not
+ * reuse a stale cookie-cache entry.
+ *
+ * @param baseUrl - App origin (`https://app.example.com`) or any base accepted by
+ *   the `URL` constructor. Resolves {@link ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH}
+ *   (`/api/auth/get-session`) against that base.
+ * @returns URL such as `https://app.example.com/api/auth/get-session?disableCookieCache=true`
+ *
+ * @example
+ * ```ts
+ * import { createFreshSessionLookupUrl } from "@xylex-group/athena/utils"
+ *
+ * const url = createFreshSessionLookupUrl("https://app.example.com")
+ * await fetch(url, { headers: { cookie: requestHeaders.get("cookie") ?? "" } })
+ * ```
+ *
+ * For auth-client base URLs that already include `/api/auth`, prefer:
+ * `resolveAthenaAuthRequestUrl("get-session", authBase) + "?disableCookieCache=true"`
+ * or pass the **app** origin into this helper when you proxy `/api/auth/*` locally.
+ */
+declare function createFreshSessionLookupUrl(baseUrl: string | URL): URL;
+
+export { ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_PARAM as A, DEFAULT_ATHENA_AUTH_ORIGIN as D, type EnvLike as E, LOCAL_DEV_ORIGIN as L, SESSION_DATA_HEADER as S, ATHENA_AUTH_DISABLE_COOKIE_CACHE_QUERY_VALUE as a, ATHENA_AUTH_GET_SESSION_ABSOLUTE_PATH as b, ATHENA_AUTH_GET_SESSION_PATH as c, ATHENA_AUTH_PATH as d, ATHENA_AUTH_UPSTREAM_ENV_KEYS as e, ATHENA_AUTH_UPSTREAM_URL_ENV_NAMES as f, ATHENA_AUTH_VERIFY_EMAIL_PATH as g, ATHENA_SESSION_DATA_HEADER as h, AUTH_SESSION_PATH as i, type AthenaAuthClientBaseUrlOptions as j, type AthenaAuthUpstreamEnv as k, type AthenaAuthUpstreamEnvKey as l, DEFAULT_ATHENA_AUTH_UPSTREAM_URL as m, DISABLE_COOKIE_CACHE_QUERY_PARAM as n, DISABLE_COOKIE_CACHE_QUERY_VALUE as o, createFreshSessionLookupUrl as p, isAbsoluteUrl as q, normalizeAthenaAuthBaseUrl as r, readAthenaAuthUpstreamUrlFromEnv as s, resolveAthenaAuthClientBaseUrl as t, resolveAthenaAuthRequestUrl as u, resolveAthenaAuthUpstreamUrl as v, resolveEmailVerificationCallbackUrl as w };